Nicehash, please tell us exactly at what time and date did you incorporate the supposedly fake phoenixminer?
Many people have whole disk/partion back ups like Acronis or Aoemi and could wipe and get their pc back minus
a few days or weeks if needed. So when did nicehashminer install the suspected malware?